Verify OSSM operator version changes after upgrade

Add pre/post upgrade check on the Subscription's status.installedCSV
to detect when the OSSM operator InstallPlan approval flow fails.
This catches the case where OLM generates an InstallPlan for the
channel head (e.g. v3.3.3) but the CIO only approves plans matching
its pinned version (e.g. v3.2.0), leaving the operator stuck on the
old version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gcs278

test/extended/router/gatewayapi_upgrade.go

@@ -29,7 +29,8 @@ type GatewayAPIUpgradeTest struct {
 	startedWithNoOLM      bool // tracks if GatewayAPIWithoutOLM was enabled at start
 	loadBalancerSupported bool
 	managedDNS            bool
-	precheckErr           error // error from Skip() to surface in Setup()
+	preUpgradeCSV         string // tracks the installedCSV before upgrade
+	precheckErr           error  // error from Skip() to surface in Setup()
 }
 
 func (t *GatewayAPIUpgradeTest) Name() string {
@@ -124,6 +125,13 @@ func (t *GatewayAPIUpgradeTest) Setup(ctx context.Context, f *e2e.Framework) {
 		g.By("Validating OLM-based provisioning before upgrade")
 		validateOLMBasedOSSM(t.oc, 20*time.Minute)
 		e2e.Logf("GatewayAPI resources successfully created with OLM-based provisioning")
+
+		g.By("Recording pre-upgrade installedCSV")
+		preCSV, err := t.oc.AsAdmin().Run("get").Args("-n", expectedSubscriptionNamespace, "subscription", expectedSubscriptionName, "-o=jsonpath={.status.installedCSV}").Output()
+		o.Expect(err).NotTo(o.HaveOccurred(), "Failed to get pre-upgrade installedCSV")
+		o.Expect(preCSV).NotTo(o.BeEmpty(), "Pre-upgrade installedCSV should not be empty")
+		t.preUpgradeCSV = preCSV
+		e2e.Logf("Pre-upgrade installedCSV: %s", t.preUpgradeCSV)
 	} else {
 		g.By("Validating CIO-based (NO-OLM) provisioning before upgrade")
 		t.validateCIOProvisioning(ctx, false) // false = no migration occurred
@@ -176,6 +184,15 @@ func (t *GatewayAPIUpgradeTest) Test(ctx context.Context, f *e2e.Framework, done
 		g.By("GatewayAPIWithoutOLM is disabled - validating OLM-based provisioning")
 		// A shorter timeout here is because the resources should already exist post-upgrade state.
 		validateOLMBasedOSSM(t.oc, 2*time.Minute)
+
+		if t.preUpgradeCSV != "" {
+			g.By("Verifying installedCSV changed after upgrade")
+			postCSV, csvErr := t.oc.AsAdmin().Run("get").Args("-n", expectedSubscriptionNamespace, "subscription", expectedSubscriptionName, "-o=jsonpath={.status.installedCSV}").Output()
+			o.Expect(csvErr).NotTo(o.HaveOccurred(), "Failed to get post-upgrade installedCSV")
+			o.Expect(postCSV).NotTo(o.BeEmpty(), "Post-upgrade installedCSV should not be empty")
+			e2e.Logf("Post-upgrade installedCSV: %s (pre-upgrade was: %s)", postCSV, t.preUpgradeCSV)
+			o.Expect(postCSV).NotTo(o.Equal(t.preUpgradeCSV), "installedCSV should have changed after upgrade, indicating the OSSM operator was upgraded via the InstallPlan approval flow")
+		}
 	}
 
 	g.By("Verifying HTTPRoute still exists and is accepted after upgrade")